Viruses - The dreaded programs:
Viruses are typically programs that are designed by pranksters as a "nice" piece of entertainment.
Here's what the WIKI has to say:
"A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user. The term "virus" is also commonly used, albeit erroneously, to refer to many different types of malware and adware programs. The original virus may modify the copies, or the copies may modify themselves, as occurs in a metamorphic virus. A virus can only spread from one computer to another when its host is taken to the uninfected computer, for instance by a user sending it over a network or the Internet, or by carrying it on a removable medium such as a floppy disk, CD, or USB drive. Meanwhile viruses can spread to other computers by infecting files on a network file system or a file system that is accessed by another computer. Viruses are sometimes confused with computer worms and Trojan horses. A worm can spread itself to other computers without needing to be transferred as part of a host, and a Trojan horse is a file that appears harmless. Worms and Trojans may cause harm to either a computer system's hosted data, functional performance, or networking throughput, when executed. In general, a worm does not actually harm either the system's hardware or software, while at least in theory, a Trojan's payload may be capable of almost any type of harm if executed. Some can't be seen when the program is not running, but as soon as the infected code is run, the Trojan horse kicks in. That is why it is so hard for people to find viruses and other malware themselves and why they have to use spyware programs and registry processors."
How many times have each of us felt the need for a better anti-virus?
Somehow the anti-virus isn't always that good, it probably just missed out one virus and as luck would have it, that virus screwed up your system. Its such a common problem that led to the cut-throat competition among various anti-virus vendors, namely Mc.Affe, Avast, Kaspersky, AVG, Nod32, and not to mention the most elusive, Norton AntiVirus.
Now, whats the reason?.. why cant one single antivirus do all the work? You update it regularly, it hogs your system resources, dictates terms to you, and finally at the end of the day, that one small pesky virus gets into your machine and poof!
Most anti-viruses today operate on a principle called as the "Signature Match"
Fair enough, it is the simplest technique to detect a program that's already been listed as "suspicious" or "dangerous".
The Technique is as simple as :-
if(signature(testFile) == knownSignature) {
Classify as a virus
}
else {
Move on to next item
}
So what is a signature?..
Signature is something like a fingerprint of the virus, more so, related to the hex-code it generates. Now hex-code is tightly wired with the program. If even a small part of the program is changed, the hex-code(signature) that it generates will be quite different from the earlier one.
There are many Hex-editors that allow you to edit the hex-code directly and make an alternative exe/dll file.
So, assume Mr. X knows this and he opened up the virus and wrote hos own name there simply to have fun. He also renamed it to whatever he wanted and then, simply "passed it on" (and changed the signature)
AntiVirus Y saw this and compared it with the known signature. As expected, it would not match! and thus the virus came out clean from the antivirus on to your system.
Subscribe to:
Post Comments (Atom)

No comments:
Post a Comment